Make it easier to bootstrap the PKI for SSL connections in OpenFlow.

[openvswitch] / controller / controller.8.in

diff --git a/controller/controller.8.in b/controller/controller.8.in
index a829951956ff65dca8c410c2909cbdc97bae344b..1df6b7528e02736d7684c380ec7872086c0fd570 100644 (file)
--- a/controller/controller.8.in
+++ b/controller/controller.8.in
@@ -68,10 +68,24 @@ controller's certificate authority (CA), that certifies the switch's
 private key to identify a trustworthy switch.
 
 .TP
-\fB-C\fR, \fB--ca-cert=\fIcacert.pem\fR
+\fB-C\fR, \fB--ca-cert=\fIswitch-cacert.pem\fR
 Specifies a PEM file containing the CA certificate used to verify that
 the switch is connected to a trustworthy controller.
 
+.TP
+\fB--peer-ca-cert=\fIcontroller-cacert.pem\fR
+Specifies a PEM file that contains one or more additional certificates
+to send to switches.  \fIcontroller-cacert.pem\fR should be the CA
+certificate used to sign the controller's own certificate (the
+certificate specified on \fB-c\fR or \fB--certificate\fR).
+
+This option is not useful in normal operation, because the switch must
+already have the controller CA certificate for it to have any
+confidence in the controller's identity.  However, this option allows
+a newly installed switch to obtain the controller CA certificate on
+first boot using, e.g., the \fB--bootstrap-ca-cert\fR option to
+\fBsecchan\fR(8).
+
 .TP
 .BR \-n ", " \-\^\-noflow
 By default, the controller sets up a flow in each OpenFlow switch
@@ -117,6 +131,16 @@ the PID of the running process.  If \fIpidfile\fR is not specified, or
 if it does not begin with \fB/\fR, then it is created in
 \fB@rundir@\fR.
 
+.TP
+\fB-f\fR, \fB--force\fR
+By default, when \fB-P\fR or \fB--pidfile\fR is specified and the
+specified pidfile already exists and is locked by a running process,
+\fBcontroller\fR refuses to start.  Specify \fB-f\fR or \fB--force\fR
+to cause it to instead overwrite the pidfile.
+
+When \fB-P\fR or \fB--pidfile\fR is not specified, this option has no
+effect.
+
 .TP
 \fB-D\fR, \fB--detach\fR
 Causes \fBcontroller\fR to detach itself from the foreground session and